CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

Parent: CWE-94 - Improper Control of Generation of Code ('Code Injection')

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

193 vulnerabilities with CWE-1336
CVE-2026-27464 HIGH
Metabase <0.57.13/0.58.x-0.58.6 - Info Disclosure
CVSS 7.7
CVE-2026-1868 CRITICAL
GitLab AI Gateway <18.6.1-18.8.0 - DoS/Code Execution
CVSS 9.9
CVE-2026-25731 HIGH
calibre < 9.2.0 - Remote Code Execution via Templite Template Injection
CVSS 7.8
CVE-2026-25526 CRITICAL
JinJava 2.7.0-2.7.5 and 2.8.0-2.8.2 - Remote Code Execution via ForTag Sandbox Bypass
CVSS 9.8
CVE-2026-23626 MEDIUM
Kimai < 2.46.0 - Authenticated Information Disclosure via Twig Template Injection
CVSS 6.8
CVE-2026-22244 HIGH
OpenMetadata < 1.11.4 - Authenticated Remote Code Execution via FreeMarker Email Template Injection
CVSS 7.2
CVE-2026-21450 CRITICAL
Bagisto < 2.3.10 - Server-Side Template Injection via Type Parameter
CVSS 9.8
CVE-2026-21449 HIGH
Bagisto < 2.3.10 - Server-Side Template Injection via First and Last Name Fields
CVSS 8.8
CVE-2026-21448 CRITICAL
Bagisto < 2.3.10 - Server-Side Template Injection via Customer Address Field
CVSS 9.8
CVE-2025-40900 MEDIUM
Angular template injection in Reports in Guardian/CMC before 26.1.0
CVSS 4.6
CVE-2025-12107 HIGH
Velocity Template Engine - Code Injection
CVSS 8.4
CVE-2025-69516 HIGH
Amidaware Tactical RMM <=1.3.1 - SSTI
CVSS 8.8
CVE-2025-46699 MEDIUM
Dell Data Protection Advisor <19.12 - Info Disclosure
CVSS 4.3
CVE-2025-64087 CRITICAL
opensagres XDocReport <2.1.0 - SSTI
CVSS 9.8
CVE-2025-68454 HIGH
Craft CMS 4.0.0.1-4.16.16 and 5.0.0-RC1-5.8.20 - Authenticated Remote Code Execution via Twig SSTI
CVSS 8.8
CVE-2025-68929 CRITICAL
Frappe <14.99.6-15.88.1 - Authenticated RCE
CVSS 9.0
CVE-2025-67843 HIGH
Mintlify Platform <2025-11-15 - SSTI
CVSS 8.3
CVE-2025-14700 CRITICAL
Crafty Controller - Authenticated Remote Code Execution via Webhook Template Injection
CVSS 9.9
CVE-2025-14731 MEDIUM
CTCMS Content Management System <2.1.2 - XSS
CVSS 6.3
CVE-2025-66438 HIGH
ERPNext < 15.89.0 - Authenticated Server-Side Template Injection via Print Format HTML Field
CVSS 8.8
CVE-2025-66437 HIGH
Frappe ERPNext <= 15.89.0 - Authenticated Server-Side Template Injection via Address Template
CVSS 8.8
CVE-2025-66436 MEDIUM
Frappe ERPNext < 15.89.0 - Authenticated Server-Side Template Injection via get_terms_and_conditions
CVSS 4.3
CVE-2025-66435 MEDIUM
Frappe ERPNext < 15.89.0 - Authenticated Server-Side Template Injection via Contract Template
CVSS 4.3
CVE-2025-66434 HIGH
Frappe ERPNext < 15.89.0 - Authenticated Server-Side Template Injection via get_dunning_letter_text
CVSS 8.8
CVE-2025-65602 CRITICAL
ChanCMS 3.3.4 - Unauthenticated Remote Code Execution via Template Injection in /vip/v1/file/save
CVSS 9.8
Details
Vulnerabilities 193
Links
MITRE CWE Entry Search this CWE With Exploits